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By Craig Henderson . Research and Statistical Support Services 

Longitudinal Growth Curve Modeling with SAS 
Proc Mixed 

This article continues the article I contributed to the May Benchmarks Online. I 
will provide the same information to review multilevel modeling in general and 
then proceed with an explanation of longitudinal growth curve modeling. 

We have begun a new series of articles to be published in the online newsletter 
put out by academic computing. In this series of articles, we will be discussing 
some advanced methods of data analysis and how they can be implemented in 
the software supported by the Research and Statistical Support office. In April, 
Rich Herrington contributed an article on the new conjoint analysis module 
implemented in SPSS 9.0, SPSS Conjoint . In this month's article, I will discuss 
hierarchical linear modeling (multilevel modeling) using SAS Proc Mixed. 

Multilevel Modeling 

In a nutshell, multilevel modeling (also known as hierarchical linear modeling 
and random coefficient modeling), is a flexible data analysis technique that 
involves analyzing linear models (e.g., the general linear model used in 
conjunction with ANOVA and regression) with a hierarchically nested structure 
(Bryk & Raudenbush, 1992). It is actually a more restrictive form of the mixed 
effects general linear model. The classic example is of students, nested within 
classrooms, nested within schools, nested within school districts, etc. Another 
frequently used application is the analysis of individual growth models designed 
for exploring longitudinal data (on individuals) over time. Basically, multilevel 
modeling models expand traditional regression methods by dropping the 
assumption of independence of observations and allowing the researcher to 
estimate both fixed and random effects on more than one level of a hierarchical 
structure simultaneously. Relationships are no longer assumed to be fixed over 
contexts (e.g., schools, time) and therefore are allowed to differ. These models 
are more realistic than traditional regression models due to making less 
restrictive assumptions; however, as Kreft (1996) points out, this generality is 
not without its price, multilevel modeling models are not parsimonious, as 
more parameters are estimated, the outcomes may be more sample specific, 
larger data sets are needed for stable solutions, and they use more complex 
estimation methods than the ordinary least squares method applied in traditional 
linear regression. 

Although multilevel models are not a panacea, finally giving researchers THE 
statistical technique that will generate theory for you, there are several reasons 
that multilevel modeling is something that researchers in the social sciences 
need to know. First, there is the problem of nonindependence of observations. 
Basically, this problem involves a situation in which clusters of individuals in 
an analysis have more in common with each other than other individuals. 
Situations in which this would be obvious are students in the same classroom, 


http://www.unt.edu/benchmarks/archives/1999/july99/rss.htm[4/22/16, 2:48:37 PM] 


























RSS Matters 


and family members in the same family. If traditional methods are used in these 
cases, standard errors will be underestimated, leading to an increased 
probability of a Type I error. However, other problematic situations are less 
obvious. The intraclass correlation is a helpful diagnostic tool in determining if 
a multilevel modeling will be superior to a traditional method, such as 
regression or ANOVA. A rough rule of thumb is when the intraclass correlation 
is over .10, hidden clusters are present in your data, and a multilevel modeling 
model would be a more appropriate data analysis technique. 

Second, in the absence of intraclass correlation, there is no improvement of 
multilevel modeling over traditional models in terms of estimating fixed effects 
(Kreft, 1996). However, this is not the case if the researcher is interested in 
estimating random effects, particularly random regression coefficients. To 
illustrate this point, a multilevel model involves the following equations: 

Yij = a/ + bjXij + e//' (1) 
aj = gOO + go l Zj + uOj (2) 

bj = glO + gllZ) + ui/ (3) 

where underlining indicates a random variable, X is a single predictor, and Y is 
the dependent variable. Index i is used for individuals, and index j is used for 
contexts. The error terms up/ and u 1/ indicate that the intercept a j and the slope 

h/ will vary over contexts. gOO indicates the grand mean, while u0 j measures the 

deviation in means across contexts from the grand mean. Likewise, glO 

represents the grand regression slope across contexts and ulj the deviation in 
slopes from the grand slope across contexts. The equations for aj and hj include 
a fixed component, gOO and glO, and a random component, uOj and u 1/. u()/ has a 

variance, too, u 1/ has a variance tit, and no/ and u 1/ have a covariance, tot. Zj 
represents a contextual level 

variable (e.g., school, person in the case of repeated measurements); therefore, 
equation (2) demonstrates that the intercept (mean) of each context is a function 
of the group level variable and random fluctuation. In equation (3), the slope is 
a function of the same group level variable and random fluctuation. The 
variances of uO )j and u 1/ and their covariance are parameters estimated in the 
model, and are found in the matrix T, which has the following structure: 

T T 

DC 01 

. ^ic ^i. 

In traditional regression, a and b are treated as fixed effects, and the random 
fluctuations are not estimated. Why is this important? By estimating the 
elements in the T matrix, we can examine the unique estimates for separate 
contexts more efficiently than by conducting separate regression equations for 
each context. Furthermore, we can now examine cross level interactions. An 
example would be the literature on aptitude by treatment interaction literature in 
education. Such research operates on the theory that teacher styles differ, and 
that some styles are more effective for certain students than for others. Instead 
of asking the question, what teaching methods are most effective, the more 
useful question of what teaching methods are most effective, for which students, 
in which contexts? 
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Longitudinal Growth Curve Modeling with SAS 
PROC MIXED 


In 1992 SAS introduced the PROC MIXED routine into their statistical package. 
It was written by agricultural and physical scientists seeking to generalize the 
standard linear model to incorporate both fixed and random effects and 
therefore did not have the needs of social scientists in mind. However, by 
correctly specifying the mixed model, a researcher can fit multilevel models and 
individual growth curve models that have become quite popular in the social 
sciences (Singer, 1997). The material for this paper is provided by Singer 
(1997), and interested readers should study her very informative, understandable 
article. Using her examples, I will provide demonstrations of how to fit a 
longitudinal growth curve model. These examples are also provided by Bryk 
and Raudenbush (1992). 

It would be helpful at this point to review the art! cl e I wrote on how to fit cross- 
sectional multilevel models with SAS PROC MIXED. In that article, I discussed 
how the three fundamental statements in SAS PROC MIXED syntax used to fit 
cross-sectional multilevel models are the CLASS statement, which identifies the 
categorical variable, the MODEL statement, which specifies the fixed effects, 
and the RANDOM statement which specifies the random effects. In this article, 

I will extend the use of the RANDOM statement to fit individual growth curve 
models. I will also discuss how growth curve models can be fit with the 
REPEATED statement. As with the cross-sectional multilevel model, I will 
begin with the example of an unconditional linear growth model. 

Unconditional Linear Growth Model 

In this model, we will begin with a simple two-level model. The level-1 model is 
a linear individual growth model, modeling the way in which each individual 
changes over time. The level-2 model expresses variation in the parameters 
from the growth model as random effects that occur between individuals (i.e., 
the change in individuals as a group over time); in the unconditional model, 
these random effects are unrelated to any person-level covariates. The equations 
to fit the unconditional model appear below; the level-1 (within person) 
parameters are indicated by p and the level-2 (between person) parameters are 

indicated by b: 


Y ij=Poj + Pi/TIME),/ + r ij 
Po/ =b oo + u 0 j 
Pl/ =b 10+ u lj 

where r ;/ ~M0,s 2 ) and 


11 n 


0 


T T 

Oj 

-A/ 



GC 01 

u 


0 

5 

T T 

L 1j\ 




L ir. IV 


Substituting the models into each other yields: 
Yy=[b 00 + b! oTIME-J + [u 0/ + u^TIMEy + r, ; J 
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This model contains two fixed effects, the intercept and the effect of TIME, and 
three random effects, the intercept, the slope for TIME, and the within person 
residual, r^. This model is a little unique in that a data set needs to be created in 

which each individual has a record for each time period that he/she is observed. 
Please see Singer (1997) for details of how to create such a data set. The syntax 
used to fit the unconditional linear growth curve model is presented below: 

proc mixed noclprint covtest; 
class id; 

model y = time/solution ddfm=bw notest; 
random intercept time/subject=id type=un; 

The CLASS statement indicates that the data represent multiple observations 
over time for individuals. The fixed effects are included in the MODEL 
statement (the intercept does not need to be written into the model statement, as 
SAS will include it by default), and the random effects are included in the 
RANDOM statement (again the intercept is included by default). The 
SUBJECT=ID portion of the RANDOM statement indicates that we want to 
allow both intercepts and slopes to vary across people. In coding the TIME 
variable, the intercept can be coded in such a way that it represents initial status 
(by coding TIME=0), average status (by centering TIME), or final status (by 
letting 0 represent the last wave of data, all other time points coded with 
negative numbers). It is usually recommended that TIME be coded in such a 
way that the intercept represents initial status. The SUBJECT= option indicates 
that the data set is composed of a set of individual subjects; the TYPE= option 
specifies the structure of the variance-covariance matrix for the intercepts and 
slopes. In our example, we are specifying an unstructured variance-covariance 
matrix. 

Adding a Person-Level Covariate 

Typically, in growth curve modeling, we are not only interested in change over 
time; we are also interested in how growth may be influenced by background 
covariates (e.g., IQ, family size, SES, etc.). This model adds some complexity 
to the unconditional growth curve model: 


Y ij=Poj + Pi/TIME)y + r y 
Pq/ =b oo + b 01 COVAR 7 + u 0/ 
Plj= b 10 + b l lCOVARy + U ly 


where r,-.~M0,s 2 ) and 


' 


0 


7 

OC 

T 

01 


0 

? 

T 

-i r 

■ r. 

T ii. 


Centering is important in such a model, because as the model now stands, the 
interpretation of the fixed effects, b ()() and b 10 , are based on a scenario in which 

the background covariate would be equal to 0. As this is most likely not the 
case, we must center the covariate at the grand mean as follows: 

Y //=P0/ + P ly (TIME) jj + r y 
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Po/=b 00 + b 01 (COVAR-Mean(COVAR)) + u 0/ 
p ij=b ! 0 + b n (COVAR-Mean(COVAR)) + u y 

where r^~A(0,s 2 ) and 


11. 


0 


T 

T 

0j 




OC 

01 

u 


0 

H 

T 

T 

L i-jJ 




L ir 

IP 


Substituting models yields: 

Y ; y=b 00 + b |0 (TIME) y . + b 01 (COVAR-Mean(COVAR))y + b u (COVAR- 
Mean(COVAR))(TIME)y + u 0/ + 



If we let CCOVAR represent the centered covariate, we can fit this model with 
the following syntax: 

proc mixed noclprint covtest; 
class id; 

model y = time ccovar time*ccovar/s ddfm=bw notest; 
random intercept time/type=un sub=id gcorr; 

We have added two fixed effects to the MODEL statement, CCOVAR and the 
TIME*CCOVAR interaction. The RANDOM statement remains the same. The 
GCORR option will print the estimated correlation matrix among the random 
effects. 


Exploring the Structure of the Within Person Variance- 
Covariance Matrix 


The above syntax examples place a somewhat unrealistic assumption on the 
structure of the within person residuals. "Were we to fit a model in which only 
the intercepts vary across persons ..., we would be assuming a compound 
symmetric error covariance matrix for each person" (Singer, 1997, p. 25). A 
compound symmetric matrix is a variance-covariance matrix in which the 
residual covariance for each individual is uncorrelated with that of other 
individuals, a rather unrealistic assumption. In addition, when we fit individual 
slopes, we introduce heteroscedasticity into this residual matrix. However, one 
of the strengths of PROC MIXED is that it allows the user to explore different 
structures of the error covariance matrix. "By considering alternative structures 
for S [the within-person error variance-covariance matrix] (that ideally derive 

from theory), and by comparing the goodness of fit of resulting models, the user 
can determine what type of structure is most appropriate for the data at hand" 
(Singer, 1997, p. 25). S For details on the structure of this matrix, the interested 

reader is referred to pages 92-102 of the book SAS System for Mixed Models 
(Littell, Milliken, Stroup, & Wolfinger, 1996). S is referred to the R matrix in 

SAS PROC MIXED terminology. 

The structure of the R matrix is specified using a REPEATED statement. With 
the assumption that the R matrix is compound symmetric, the PROC MIXED 
syntax would be as follows: 
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proc mixed noclprint covtest noitprint; 
class id wave; 
model y = time/s notest; 
repeated wave/type=cs subjected r; 

In the above syntax, WAVE is included as a CLASS variable. WAVE refers to 
the wave of data collection (i.e., 1st collection, 2nd collection, etc.). WAVE is a 
series of dummy-coded variables, as opposed to TIME, which is a continuous 
variable. This is because the variable specified in the REPEATED statement 
must be categorical. With the TYPE= option, we specify the structure of the R 
matrix, in this example, compound symmetry. Other possible structures include 
UN for unstructured and AR for autoregressive. The R option above requests 
SAS to print out the R matrix. The idea is to try several different error structures 
and to compare the goodness of fit statistics for the models specifying different 
error structures. Please consult pp. 92-102 of the SAS System for Mixed Models 
for details. 

Now, putting the information for structuring the R matrix with the model we 
previously tested that included a person-specific background covariate, our SAS 
PROC MIXED syntax becomes: 

proc mixed noclprint covtest noitprint; 
class id wave; 

model y = time ccovar time*ccovar/s ddfm=bw notest; 
random intercept time/type=un sub=id g; 
repeated wave/type=ar( 1) subjected r; 

The AR(1) option indicates an autoregressive structure with a lag of 1. 

I hope that I have helped provide you with some information in which you can 
jump off into multilevel modeling. My opinion is that as structural equation 
modeling has increased in popularity, the same will happen with multilevel 
modeling. The ability to test variance components and cross-level interactions 
are particularly appealing features of this up and coming approach. 

Psychology's Dr. Ke-Hai Yuan will be instructing a class on multilevel 
modeling in the fall, for those of you who would like to pick up another 
methodology class, or for those of you who are faculty and would like to sit in 
on a class. Please contact me, craigh@unt.edu . if I can assist you in any way in 
implementing multilevel models or for other help as well. Enjoy your 
researching, and good luck. 
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Network Connection 

By Dr. Philip Baczewski . Associate Director of Academic Computing 

This is an encore presentation of a "Network Connection" from 1998 . We have published 
other articles on various aspects of his topic, most recently 'Virus Alert' and the April 
'Network Connection .' — Ed. 

Keeping yourself safe from the Internet 


Franklin Roosevelt said it best: "The only thing we have to fear is fear itself...." Some people 

would have you believe, however, that you should fear the Internet that somehow, having an 
Internet connection exposes you and your computer to unprecedented peril. This 
phenomenon evidences itself in the recurring Internet E-mail virus scares that crop up, and is 
now also exploited by some wily software marketers. 

Should we fear the Internet? It is very easy to fear what is unknown, and to many people, the 
Internet is a vast unknown. Many are now using E-mail in the course of their job or 
education, but don't really know how the Internet works. Likewise, there has been an equally 
dramatic rise in the number of home computers subscribing to Internet services. Service 
providers are making it very easy to connect, but is it safe to use such services? 

I think that with a bit of education and reason, we'll see that perhaps the Internet is not as 
dangerous as it is portrayed to be. Security and privacy concerns should not be ignored, 
however, a little knowledge can go a long way in helping you protect your interests while 
utilizing the Internet. A couple of examples will help us understand how some Internet 
threats are non-existent, while others are blown out of proportion. 

Finding a cure for the E-mail virus 


It invariably happens. Someone gets an alert about a deadly E-mail virus, and since the mail 
has been sent some computing company or military address, they decide that it must be true, 
coming from such an authoritative source, and they forward it to their entire department, or 
to an entire organization. The message usually goes something like this "If you get any mail 
with blah blah blah' as the subject, delete it immediately if you read the message, it will 
erase your hard drive." 


Time for a reality check. E-mail messages are text. E-mail is transmitted as text. E-mail 
messages are processed by your E-mail program as text. Text is simple data one byte per 
character. Text is like an inert object. You can manipulate it, but by itself, it will take no 
action. Attachments to E-mail messages can be programs, however, while they are being 
transmitted over the Internet, they are sent as encoded text. Even if someone sends you E- 
mail with an attached program, until you direct your E-mail program to decode and save an 
attachment and you run it as a program, an attachment cannot act on its own. It certainly 
cannot operate through your E-mail program. Reading an E-mail message might do harm to 
your psyche, but it can't, on its own, harm your hard drive. (For more information about 
computer virus myths and hoaxes, see http://www.kumite.com/myths/) 


That said, you have to remember that once you work with an E-mail attachment outside your 


http://www.unt.edu/benchmarks/archives/1999/july99/netcom.htm[4/22/16, 2:48:38 PM] 

























The Network Connection 


E-mail program, you then have to be careful. Microsoft Office documents can contain 
"Word macro viruses." Programs of undetermined origin might be infected with a computer 
virus. Both of these hazards can be guarded against by making sure that you have an up-to- 
date and working virus protection program. 

Cookies and Applets 


Cookies and applets these are sweet snacks, right? Not harmful to anything but your 
waistline, right? Well maybe that's true in the kitchen, but where the Internet is concerned a 
cookie is information stored by your web browser that can be used by a WWW server to 
identify your computer has having visited their site before. As we saw in the Network 
Connection published in the September/October 1997 Benchmarks , cookies have a number 
of legitimate uses, and when you use the controls available within your web browser, you 
can easily guard your privacy and prevent unwanted cookies from being set. 


Applets are small programs written in a language which makes them easily transmitted over 
the Internet. The most common language for applets is called Java, and was developed by 
Sun Microsystems. Microsoft has developed a competing language called ActiveX. Because 
these programs actually run on your computer via facilities included in your Web browser, 
they can potentially have access to the files on your hard disk. Fortunately, browsers such as 
Netscape provide you with control over which applets will be allowed to run on your 
computer. Netscape Communicator version 4 will even provide you with an estimate of the 
security risk associated with any particular Java applet (see the Security selection of the 
Communicator menu in Netscape to get more information about or configure Java security). 

The best way to guard against security or privacy breaches from Internet cookies or applets is 
to become familiar with the controls for these features within your Web browser. The online 
help can be very useful for learning more about them and about your options for using them 
or preventing these features from being active. There are also a multitude of books, written 
for a non-technical audience, about Web access and about specific browsers. 


Your Best Defense 


Information is your best defense against invasions of your privacy or security. While some 
enterprising software marketers might sell you a program which claims to guard your 
computer and files, by using such a program you are putting your trust in that company 
rather than in your own good sense. If you educate yourself about how your browser works, 
then software to guard you from the Internet is not necessary. 

Keeping your computer programs and data secure is a serious concern, especially if you rely 
on your computer for important business or personal information. Before you run out and by 
software to protect you from the Internet, however, you'd better be sure that you have two 
important facilities in place and are using them: have backup software for your hard disk and 
use it on a regular basis; have virus protection software which is active and up-to-date. With 
these basic tools and some knowledge of the security features of your Web browser, you can 
guard your own interests and feel much more secure about your Internet use. 


Comments, Questions? Send them to Philip Baciews . 
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List of the Month 


Each month we highlight one Internet, USENET Special Interest Group (SIG), 
or similar mailing list. 


HeroicStories 


Do you get tired of reading and hearing bad news when you pick up a 

newspaper or turn on the TV? If so, HeroicStories will be a welcome diversion 
It is guaranteed to brighten your day and restore your faith in humanity. As 
Randy Cassingham, the owner of the HeroicStories puts it: 


You always hear about the people who do wrong, hurt others, 
take advantage, rob and steal. But they are the minority. 
HeroicStories are about everyday real people who step up to 
the challenge and do right when things go wrong. It's not just 
the people who save lives or stop a crime, but the stories are 
true, they're from all over the world and, most of all, they're 
interesting — not sappy, syrupy-sweet tales you roll your eyes 
over when your grandmother tells them. 


To receive "HeroicStories" by E-mail for FREE, send a blank E-mail to 
.Ioin@HeroicStories.com or see the HeroicStories Web site at 
http://www.HeroicStories.com 

HeroicStories is a "This is True" project (see http://www.thisistrue.com for info) 
and is published by Freelance Communications, PO Box 17326, Boulder CO 
80308 USA. HeroicStories is a trademark of Freelance Communications and is 
available to newspapers for FREE as a feature column. 
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By Mark Wilcox . Campus Web Administrator 

Web Publishing: It's About to Get Easier 


There's a new protocol that is destined to take the Web to yet another level. In just a short 5 

years (yes It's only been 5 years) the Web has transformed computing in ways most people 
never dreamed was possible. While I still believe E-mail is the "killer app" because people 
love to talk to each other. The Web is a close second, though, because people like to talk 
about themselves almost as much as they like to talk to each other. Internet E-mail was 
around a long time before the Web, but people didn't start to use E-mail that much until the 
advent of Web. I don't think it's any coincidence that free PCs didn't appear until everyone 
started to get on the Internet to send E-mail and look at Web pages either. 

Official Communications 

We're starting to take another evolutionary step even here at UNT. This fall we will test out 

whether or not we can use the Internet (e.g. E-mail) as an official communications 

2 

mechanism for students. And that's only the start. 

While we've done a fairly impressive job in providing content on the Web (both official 
documents and personal pages) we know we are just starting. And until it becomes as easy 
as typing up a paper in Microsoft Word and saving it to your local hard-drive, it really won't 
reach its full potential (while it's true you can save your documents to a networked drive that 
then is loaded by a Web server, this doesn't work when you're at home or in another part of 
the world ;). In particular when it comes to official documents. 

This is because it takes too much time to create a document in one format and then have to 
translate it with a Web development tool. Most of our documents are now created in 
something like MS Word and don't need a bunch of fancy graphics. They just need to be 
available. Even as easy as Microsoft FrontPage is to use (FrontPage is our primary 
departmental Web development tool), it's still extra work. 

The best thing about FrontPage? Its ability to save Web pages to a remote server, as if the 
server is local. That and the fact you can make forms in a couple of mouse clicks ;). But 
FrontPage isn't for everyone. I know that. We all know that, but your only other option to 
publishing a Web site is to use FTP. Yuk. I don't mind FTP, but then I'm the Webmaster. For 
most people, FTP is a scary concept. It's not very simple to use when you only need to use it 
every once and a while. 

WebDAV to the Rescue 

Luckily there's hope. A bunch of companies including Microsoft, Novell, and Netscape have 
gotten together to develop an extension to HTTP (the protocol we use when we're on the 
Web) to develop a common Web authoring mechanism. It's called WebDAV, which stands 
for Web Distributed Authoring and Versioning. 

WebDAV is designed to enable people to publish Web pages in collaboration with others. 
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Those others may be in the office next door, in the next building, or in a different country. 
The versioning part of the WebDAV name means that you can save several drafts of a 
document and revert back to one of those drafts if the most recent changes are un¬ 
acceptable. 

WebDAV is designed to be more efficient than FTP because HTTP 1.1 enables you to use a 
single Internet connection to send multiple files, while FTP requires a different network 
connection for each item. WebDAV can also transfer only the bits that change between two 
documents, which further reduces network traffic. That in turn improves performance and 
reduces network congestion. Because HTTP can use Secure Sockets Layer (SSL) for 
improved security, it's more secure than FTP. Finally — well that's not all, but it's probably 
the most important part — WebDAV has the support of all of the major Internet companies. 

Office 2000 (actually all you need is IE5) supports the concept of Web Folders. Web Folders 
support either FrontPage Server Extensions or WebDAV. Web Folders connect to your 
Windows Explorer and enable you to save files to a folder on your PC that actually transfers 
those files to the remote server. You can even do full file management operations like 
create/rename/move/delete folders and files. Even Novell's GroupWise will take advantage 
of WebDAV with it's new Web publishing features. 

What does that mean for us at UNT? 

Well I hope to be able to offer WebDAV functionality to students at some point in the fall on 
people.unt.edu and to faculty/staff as well for their course/departmental sites during a similar 
time frame. Since we already have good FrontPage support for faculty/staff, though, I'm 
doing my best to get this done for students more quickly. 

Now if being one of the first universities to offer WebDAV support to its student population 

3 

doesn't land us in the Yahoo Most Wired Universities list, I'm not sure what will. :) 

Until next time. 


1 

A protocol is a fancy term to mean the "rules" computers follow to talk to each other. 

2 


For more information on this topic see the May 1999 article 


UNT was named one of America's 100 most wired colleges 
in 1999. 


Campus Computing News , 
in 1998, but lost the distinction 
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Short Courses 


By Claudia Lynch . Benchmarks Editor 

Summer Short Courses continue through August 10. There is still time up to 

sign up for classes in S-Plus, Creating a Homepage with FrontPage, and WebCT 
Basics. These classes are all free for UNT students, faculty, and staff members. 
Follow this link for course descriptions and registration. 

Especially for New Students 

This fall, Academic Computing Services will be offering a course for people — 
especially students — who are new to UNT. The course, titled "Introduction to 
Computing Services at UNT," will be available on a first-come, first-served 
basis. Following are the dates and times for this course: 

Three two-hour sessions, held in the SLIS Computer Classroom (ISB 203): 

• Tuesday, August 24, 2-4 p.m. 

• Wednesday, August 25, 2-4 p.m. 

• Thursday, August 26, 2-4 p.m. 

Three two-hour sessions, held in the Eagle Student Services Lab (ESS 152): 

• Monday, August 30, 2-4 p.m. 

• Tuesday, August 31, 2-4 p.m. 

• Wednesday, September 1, 2-4 p.m. 

Customized Short Courses 

Faculty members can request customized short courses from ACS, geared to 
their class needs. Other groups can request special courses also. Contact ACS 
for more information (ISB 119, 565-4068, lynch@unt.edu ). 

Especially for Facuity and Staff Members 

In addition to the ACS Short Courses , which are available to students, faculty 
and staff, staff and faculty members can take courses offered through the 
Human Resources D epartment, the Center for Distributed Learning , and the 
UNT Libraries' Multimedia Development Lab . 

Center for Distributed Learning 

The Center for Distributed Learning offers courses especially for Faculty 
Members. Topics include Windows 95, PowerPoint, Video Conferencing, and a 
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series of classes concerning putting course materials on the World Wide Web 
using WebCT®. 

The center offers a "Brown Bag" series which meets for lunch the first Thursday 
of each month at Noon in ISB 204. The purpose of this group is to bring faculty 
members together to share their experiences with distributed learning. One 
demonstration will be made at each meeting by a faculty member with 
experience in distributed learning. Each meeting is followed, for those 
interested in using WebCT®, by a one hour orientation for beginners in ISB 
203. More information on these activities can be found at the Center for 
Distributed Learning Web site. 




" " "Distributed Learning Crash Course*** 


Who Is It For? Faculty members interested in integrating technology with 
their classes to distribute their course content at a distance. 


Course Overview: Basic steps needed to publish your syllabus, notes, 
PowerPoint presentations, and assignments on the Web, to communicate 
electronically with your classes, and teach using videoconferencing. 

When Is It Offered? August 16-19, -1999 7 -• : 

Check out http://www.unt.edu/cd1/d1courses.htm for a detailed course 
schedule, course descriptions, and online registration. If you need additional 
information about the classes, contact Kim Crawford at 940-565-2708. 


UNT Libraries’ 

The UNT Libraries' Multimedia Development Lab has also offered free training 
to all University of North Texas faculty and staff in the basics of FrontPage 98 
and information architecture in the past. For more information visit the 
Multimedia Development Lab's home page at http://www.library.unt.edu/mmdl 


Technical Training 

Technical Training for campus network managers is available through the 
Campus-Wide Networks division of the Computing Center. Some of the 
seminars , such as one on disaster recovery /business continuity planning 
techniques, may be of interest to others on campus as well. 

Alternate Forms of Training 

The Training Web site has all sorts of information about alternate forms of 
training. Training tapes, Computer Based Training (CBT) and Web-based 
training are some of the alternatives offered.There are also handouts for 
computer training (Microsoft Office 97 and Windows 95) on the following 
topics: 

• GroupWise 5.2 — Handout for Win95/NT 

• FAQ for GroupWise 5.2 
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• Info on GroupWise for Win3.1 

• Computers - Back to the Basics 

• Introduction to Windows 95 

• Introduction to Word 97 

• Advanced Word 97 - MailMerge It Together 

• Introduction to Excel 97 

• Introduction to PowerPoint 97 

• Introduction to Remedy (THE Call-Tracking Program) 

• Using Netscape Communicator and the UNT Home Page 


http://www.unt.edu/benchmarks/archives/1999/july99/short.htm[4/22/16, 2:48:42 PM] 



IRC News 


Page One 

Campus 

Computing News 

"Pass the word. 
Please" 

Round Reel 
Revolution 

Students in the 
Tree 

ssh ... 

The New 
Wordmarks are 
Here! 

The Software 
Crisis 

RSS Matters 

The Network 
Connection 

List of the Month 

WWW@UNT.EDU 

Short Courses 

IRC News 

Staff Activities 


News 

Minutes provided by Sue Ellen Richey, 
Recording Secretary 




IRC Regular Voting Members: Ginny Anderson, Fiscal Affairs; Donna Asher, Administrative Affairs; Walter 
Bowen, Academic Administration; Bill Buntain, Communications Program Group; Sue Byron, Faculty Senate; 
Carolyn Cunningham, Student Affairs; Don Grose, Libraries; Jenny Jopling, Instruction Program Group; Joneel 
Harris, Administrative Program Group; Allen Livingston, Graduate Student Council; Dennis Mueller, Research 
Program Group (on Sabbatical); Ramu Muthiah, School of Community Services; Jon Nelson, College of Music 
and Standards & Cooperation Program Group; Robert Nimocks, Director, Information Technology, UNTHSC; 
Steve Oeffner, UNT Health Science Center Russ Pensyl, School of Visual Arts; Patrick Pluscht, Distributed 
Learning Team; Jim Poirot College of Education; Mark Rorvig, Research Program Group (acting for Dennis 
Mueller who is on Sabbatical); Kathleen Swigger, College of Arts and Sciences; Neal Tate, University Planning 
Council; Philip Turner, Associate Vice President of Academic Affairs for Distance Education and Dean of the 
School of Library and Information Resources (Chair, IRC); ; Virginia Wheeless, Chancellor; John Windsor, 
College of Business. IRC Ex-officio Nonvoting Members: Leslie Bowden, Telecommunications; Wil Clark, 
GALMAC; Jim Curry, Microcomputer Maintenance Shop; Michael Forster, UNT Health Science Center; Richard 
Harris, Computing Center; Coy Hoggard, Computing Center; Maurice Leatherbury, Computing Center; Sue 
Ellen Richey, Computing Center (Recording Secretary). [As of 1/99] 

June 15,1999 

Distributed Computing Support Management Team 

Maurice Leatherbury reported for the Distributed Computing Support Management Team 
that the committee is still looking at position descriptions in an attempt to lower the 
educational requirements for most computer support positions so that student employees 
who have experience working in hourly LAN support positions can apply for those 
positions. The changes the committee is proposing will have to be approved by Human 
Resources. The committee has also discussed the issue of dorm and lab support and will 
soon take a recommendation to the Standards & Cooperation Program Group for 
presentation to the IRC. 

Y2K Compliance 

Coy Hoggard reported that the new Voice Response system equipment that was ordered for 
Y2K compliance has arrived. There are some issues regarding pricing of digital lines that are 
having to be worked out with GTE. Some testing for Y2K compliance is still being done, but 
they are essentially finished testing on the centrally supported applications. Ginny 
Anderson’s committee continues to work on contingency plans for the year roll-over. 

Instruction Program Group 

Jenny Jopling reported that the Instruction Program Group is looking into the possibility of a 
license for Macromedia’s Shockwave so that it can be stored on a local server, rather than 
having to be downloaded for use in general access labs. 
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Communications Program Group 

Paul Schlieve reported that the Communications Program Group is working on three 
initiatives: 

1) trying to determine whether the planned firewall implementation is going to impact the 
academic and research community, and if so, trying to figure out a way to avoid that; 


2) continuing to study the impact of using caching servers to make more efficient use of 
internet bandwidth to the outside world; and 3) campus wiring project to move everything to 
lOOmb switch ethernet. Mike Maner added that the Computing Center is collecting best 
offers and design proposals from several vendors. 

Research Program Group 

Mark Rorvig reported for the Research Program Group that they are preparing for the second 
round of proposals to the National Science Foundation for an Internet 2 grant. Proposals are 

due July 31 st and Mark asked IRC members to send him any information they might have on 
meritorious applications that could be included in the proposal. 

Standards & Cooperation Program Group 

Elizabeth Hinkle-Tumer reported for the Standards & Cooperation Program Group. She 
distributed a draft of a University Computing Assessment and Resource Guidelines 
document. The committee has assessed different levels of users and machines needed by 
those users to accomplish many different tasks. The document is based on the collective 
experience of the program group members as well as on surveys taken of the computing staff 
in all areas of the campus. User categories and processes have been devised and hardware 
and software recommended for those processes to aid departments when making purchasing 
decisions. The guidelines are not designed for use by students in making their decisions to 
purchase computers or software. Elizabeth pointed out that the guidelines reference the 
existing policy regarding the 3-year computer upgrade plan. In the discussion that followed, 
there was a concern expressed that these guidelines may become policy. John Windsor 
commented that some users don’t really fit the user categories. Elizabeth responded that the 
guidelines are to help those who need help in making purchasing decisions. Elizabeth asked 
that members send comments to ehinkle@music.unt.edu . or call her at 3766, prior to the July 
IRC meeting. 

There was some discussion regarding developing similar guidelines for students. Since many 
students take web-based courses now, it is important that they know what level of hardware 
and software is needed for the various courses. There was some concern that minimum 
requirements are not presently communicated to students before they enroll in these courses. 
Jenny Jopling reported that she is working with the Distributed Learning Steering 
Committee to develop a template Web page that will provide hardware and software 
requirements for each web course. It was suggested that when students first visit UNT, even 
prior to their enrollment, their orientation include some basic computer recommendations for 
courses that require computer work. Maurice Leatherbury reported that the Computing 
Center Help Desk currently helps students who ask for advice on what computer hardware 
and software they need to buy. 

Elizabeth also distributed a draft Policy and guidelines for Student E-Mail, and Maurice 
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Leatherbury discussed the document. Plans for a bulk e-mail system have been in process for 
quite some time. There are many messages that need to be sent to all students, which this 
proposed system will enable. 

The plan is to provide a user ID and an e-mail address for every student in the UNT system, 
and to put a bulk e-mail system in production by Fall. Maurice pointed out that the system 
will only be used for official communications. The student database will be provided 
through SIMS and updated daily. The draft guidelines include a grid showing who has 
authority to send bulk e-mail messages. 

In the discussion that followed, a question was raised regarding the provision of additional 
help desk staff when the system is first offered. It was pointed out that the system can be 
used by faculty sending e-mail to students in their classes, possibly on a daily basis. It is 
anticipated that e-mail to the entire student body would be occasional, rather than daily. It 
was pointed out that it would be useful for an instructor to be able to send e-mail to students 
enrolled in a class, even prior to the beginning of that class. Maurice said he would 
investigate that possibility. 

David Griffiths stated that he would bring this issue up at the next Student Association 
meeting and report back to the IRC. It is possible that when students are required to log into 
the e-mail system at least once a week to check for messages, there may be an overload on 
the General Access Labs. Maurice noted that the University Union is planning to install 
some e-mail workstations in computer Kiosks just for this purpose. Students can forward 
their e-mail from their UNT-assigned ID to their own personal internet service mailbox. Phil 
Turner suggested that some incentive program be used by the Student Association to entice 
students to use the new e-mail system. This proposed Student E-mail policy and guidelines 
will be presented at the July IRC meeting for a vote. IRC members may send their comments 
to Maurice Leatherbury prior to the July meeting. 

Distributed Learning Team 

Patrick Pluscht reported for the Distributed Learning Team that they have recently been 
awarded a grant for a one-year connection to the Region 11 network, including line charges 
and hardware. Region 11 is the education service center that is based out of Tarrant County, 
a 10-county region that is north and west of Tarrant County. They are a provider of internet 
services as well as video-conferencing access. With the grant UNT was awarded, DLT can 
provide two-way interactive video courses to the ISD’s. In years two and three of the grant 
period, UNT will have to pay a membership fee and the line charges. UNT will also have to 
offer two concurrent enrollment courses to High School students in advanced science, math 
and/or foreign languages. Patrick also reported that the Center has a marketing person 
working with them full time during the summer to develop a publication describing what is 
available through the Center for Distributed Learning, in all the different colleges and 
schools here. That person will also serve as liaison to the individual units to help with their 
marketing efforts. Patrick also announced that there are some grant opportunities coming up 
and they have someone working with them to help in writing grant proposals. 

Microsoft Campus Agreement 

In response to a question from David Griffiths, Maurice Leatherbury explained that the 
Microsoft Campus Agreement is now being reviewed by the University Attorney, and in its 
current form, it will not include students for the first year. It will be necessary to get Student 
Association approval prior the end of this first year of the agreement if students are to be 
included in the second year. 
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IRC Meeting Schedule 

The TRC generally meets on the third Tuesday of each month, from 2-4 p.m., in the 

Administration Building Board Room. An exception to that schedule occurred in March of 
1999 when it met on the second Tuesday to accommodate the Spring Break schedule. 

All meetings of the IRC, its program groups, and other committees, are open to all faculty, 
staff, and students. 
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Staff Activities 


Transitions 

The following are new employees: 

• Steven Bauer, Telecommunications Assistant (part-time). 

• Matthew Bryan Mefort, Communications Systems Technician (part- 
time). 

• name removed by request, Data Entry Operator. 

The following people no longer work in the Computing Center: 

• Shobha Kasireddy, Report Distribution Clerk (part-time). 

• Jason Laughlin, Communications Systems Technician (part-time). 

• Sue Carrigan, Data Entry Operator. 

• Patrick Dunn, Telecommunications student assistant (part-time). 

• Paul Landes, ACS Lab Checkin Tech Support (part-time). 

• Kenn Moffitt, Web Developer, Central Web Support — left to work in a 
similar position in PAIS. 

Awards, Recognition 

• Claudia Lynch, ACS Documentation Services Manager and Benchmarks 
Online Editor, was recognized in the July 1999 inHOUSE for 20 years of 
service to UNT. 

• Ramona Aref-Azad, Production Control Scheduler, was recognized for 5 
years of service in that same issue of inHOUSE. 
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Campus Computing News 

By Dr. Maurice Featherhurv . Senior Director of Academic Computing 

Microsoft Campus Agreement Really is Coming 
Soon 

Back in May, I wrote that software products under the Microsoft Campus 
Agreement should soon be available on campus. Although it's taken much 
longer to finalize the details of the agreement, we're hopeful that we'll be able to 
start installing the software within the next two weeks (by the end of July, at 
least.) To reiterate what is covered under the campus agreement, here's the list: 

• Microsoft desktop operating system upgrades (Windows 95, Windows 98, 
Windows NT 4.x, Windows 2000, etc.) 

• Office Professional (including Office 2000.) This package includes Word, 
Excel, PowerPoint, and Access. 

• FrontPage (including FrontPage 2000). 

• Visual Studio Professional. This package includes development software 
such as Visual Basic, Visual C++, and Visual Interdev. 

• BackOffice Server Client Access Licenses. This is necessary if you're 
using Windows NT servers. 

• MS Press Office Starts Here Step-by-Step Interactive. This is a CD-rom 
tutorial package on Office. 

• Macintosh versions of Office and FrontPage are covered under the 
Campus Agreement as well. 

Faculty and staff will have the right to run one copy of each of the software 
package, for school related activities, on either a laptop or desktop that they own 
or lease. Tentatively, the vendor of our Campus Agreement will make copies for 
sale in the Bookstore for a fee of $6.50 per CD (Office 2000, for example, 
comes on two CD's, so your cost would be $13 for that product that normally 
costs $200 to academic users.) It will probably take about two months to work 
out all the details of bookstore sales and tracking of faculty and staff purchases, 
so don't expect to be able to buy the software as soon as the agreement is finally 
signed. 

Your network manager should be able to answer questions about the Campus 
Agreement (and as of this writing they're waiting to hear from us that all the 
details of the agreement have been finalized.) 

Discussions with the Alliance for Higher 
Education about an Internet 2 GigaPOP 
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UNT is an Internet 2 member, meaning that we belong to the organization 
(UCAID) that administers that high-speed academic network. However, our 
campus is not yet connected to the actual Internet 2 data communications 
network: the cost of connection is quite high and our proposal to the NSF for 
funding a major portion of the cost wasn't successful on our first try in January. 
1999 . 

We have been meeting with a group of north Texas universities, under the aegis 
of the Alliance for Higher Education (AHE), to discuss the formation of a 
gigaPOP (gigabit Point of Presence) to pool the data connections of regional 
universities and share the costs of Internet 2 connectivity. For the past two 
months, Bill Buntain, Director of Networking and Communications Services, 
has met periodically with representatives from AHE, SMU, TCU, UTD, UTA, 
TAMU Commerce, and UT Southwestern to work out the details of the 
technical, administrative, and financial issues of such a gigaPOP. While we are 
still far from completing the design of the proposed system, we are encouraged 
at this point by the cost savings potential of a north Texas gigaPOP. We still 
have to find funding for the connection, which could easily exceed 
$200,000/year for the gigaPOP. Dr. Mark Rorvig is revising our application for 
resubmission to NSF for a Connections Grant which, if funded, would provide 
up to $350,000 for two years. If you have any applications that require high¬ 
speed Internet 2 connectivity, be sure to let Dr. Rorvig know so they can be 
included in the proposal. 
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Computing Center Helpdesk Migrates to 
Automated Password Change System 

By Dr. Tv Young . UNIX Systems Administrator 

Chances are good that, at one time or another, you've had to go to the 

Computing Center's Helpdesk offices in the Information Sciences Building, 
Room 119, in order to request a new password for an account you have on one 
of our UNIX host systems known as Jove and Sol. Since passwords on our 
systems are one-way encrypted, we can't look up your old password, so we 
have to issue you a new password if you've forgotten or lost your old one. You 
probably know the following scenario all too well: 

The Problem 

You've received a yellow copy of the 'Password form' containing your userlD 
and a new password that the Helpdesk staff member made up for you, on-the- 
fly. "Gee," you think, "this password isn't so bad. I can live with it for now. I'll 
change it later." So you trot off to one of the General Access labs to check your 
E-mail, buoyant that you've finally got a password that will work. 

You try logging in; it doesn't work. After another six hours of waiting, it still 
doesn't work. You give up and go home. Unfortunately, you managed to leave 
your "yellow sheet" beside the computer in the lab, so you've now created three 
problems: 

1. The next person who sits down at the computer you'd been assigned has 
(or will, when the password change finally does go through) access to 
everything related to your account: your programming code, your term 
papers, your E-mail to that guy or girl you met last Friday, etc. 

2. Now you'll have to come back to ISB 119 to get another password, 
because you've lost the password sheet we gave you before. 

3. This has the effect of delaying your ability to E-mail your professor or 
advisor yet another day. you've just compromised security on our host 
systems, because the person who picks up your password sheet happens 
to know something about UNIX (there are a lot more of them out there 
than you might think!) and how to exploit vulnerabilities in operating 
system. If s/he does this, you're held responsible, because (as we pointed 
out when you received your account from us) you're responsible for all 
actions associated with this account. And if s/he actually compromises a 
system by deleting essential files or entire filesystems, it may take us days 
to clean up the mess and restore things from tape back-ups, during which 
time nobody on campus can use their UNT Internet accounts. 

Obviously, this is a big issue for you, and for us as well. We tell you when we 
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assign the new password to you that you're required to change your password as 
soon as possible so that you, and only you, know the valid password for your 
account. But we sort of get the impression that a lot of you don't do that as 
quickly as we' advise. (Of course, if you did change your password as soon as 
possible after getting the new one from us, none of the three risks above would 
come into play.) 

The Solution 

The Helpdesk is using a newly-developed, WWW-based system for changing 
passwords on UNIX host systems. It's essentially an electronic version of the 
"yellow sheet", but we've added a few features to the Helpdesk's procedure, in 
order to serve you better. Here's how it works: 


1. You come into the Helpdesk area and tell us you need to reset your 
password for your UNT Internet Account. 

2. We request your UNT ID card. If you don't have one, you need to get one, 
because it's official identification that you're connected with the 
University. Students, full-time and part-time (even hourly) faculty and 
staff are required to carry one (see "Identification Regulations" at 
http://www.unt.edu/student/other rules.htm ). 

3. We swipe your card through a card reader we have connected to a couple 
of machines in the Helpdesk area. By the way, we've done something 
called 'domain-restricting' to these Web pages to ensure that they're only 
accessible by the machines in the Helpdesk, and then only by our 
Helpdesk staff-members. 

4. The system pulls up your accounts, and we ask for which account (if you 
have more than one, which most of you won't) it is that you'd like to have 
the password reset. When you tell us, we verify that this account really is 
yours, and that it's an active, working account. 

5. When we've verified all that with you, we click on a button on the screen, 
and, seconds later, a page emerges from our printer, displaying your 
name, username and a new, randomly-generated password. 

6. We tell you that, by accepting this new password, you've agreed to change 
your password to something that you and only you know, as soon as 
possible. 

7. Your password is reset, automatically, within 30 minutes of the time you 
requested the change (usually less!) 

Remember that UNT Computing Center policy (section 4.2.l.d) requires you to 
change your password as soon as possible after receiving a temporary password 
from the Helpdesk area. The password should be known only to you. It goes 
without saying that you should never write down a password: commit it to 
memory, and destroy any written record of present or previous passwords you 
have on any system. For help in developing your own password scheme, you 
might check out our " Password Change Information " Web page. 


http://www.unt.edu/benchmarks/archives/1999/july99/password.htm[4/22/16, 2:48:45 PM] 





"Pass the word, please" 


If you have a question about your UNT Internet account, please contact the 
Helpdesk at (940) 565 2324 or helpdesk@unt.edn — or, better yet, stop by in 
person (ISB 119)! If the Helpdesk group is unable to answer your question, 
they'll open a trouble call and assign it to an appropriate Computing Center 
support group, and your will get an answer as soon as possible. 
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Round Reel Revolution 


By Dr. Philip Baczewski . Associate Director of Academic Computing 

Hitachi Data Systems has dropped all support for the old 9-track round reel 

mainframe tape drives effective September 1, 1999. This means that beyond that 
date, Computing Center Mainframe Operations will no longer be able to get 
those drives serviced, should they break. Effectively, this means that we cannot 
ensure the ability to read a 9-track tape on our academic mainframe beyond 

September 1. 

It has been about 5 years since the round reel tape drives have been in regular 
use. During that time, newly written tapes have used the newer cartridge 
technology format. If for some reason, you have data on round reel tape which 
must be converted to an alternate format, now is the time to consult with 
Academic Computing Services personnel. Research and Statistical Support 
Services staff (565-2324) will be glad to advise you in this regard. 

Please be aware of the following in regard to reading round reel tapes: 

1. Because the media on old round reel tapes has proven unreliable, there is 
no guaranty that data can be successfully read from old tapes. 

2. Copying data from tapes requires your consultation and involvement, 
because the format of the data is not evident from the data set names on 
tape. 

3. ACS will provide consultation services, but we will not be responsible for 
copy data from any personally held round reel tape internal or external to 
our tape library. If you wish such data to be preserved, it is your 
responsibility to perform any data copying. As a courtesy, active faculty 
academic mainframe users with tapes in the mainframe round reel library, 
will receive a message to their mainframe user-ID listing the tapes and 
number of data sets (this is less than 35 people). If you don't receive such 
a message, then you do not have round reel tapes held in the Mainframe 
tape library. Please remember that even if the data was previously copied 
to a cartridge tape, the original round reel tape may still be in the library 
because of it was initially written without an expiration date. 

If you have further questions, please contact ACS Research and Statistical 
Support (Karl, Rich, or Craig) via the Computing Center helpdesk (565- 2324). 
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Students in the Tree 


By Allen Bradley . Manager, Campus Wide Networks Computing Team and Pat 
Evans . Campus Wide Networks Computer Support Specialist 


Students in the Tree. No, it’s not the name of a new rock group or comedy troupe like 

Kids in the Hall, and no, it’s not a reference to students enjoying the greenery, but it is 
something new that will be a part of your UNT life before too long. Students in the Tree 
is the big project of the summer (and actually for some time prior) that will be making 
the coming semesters easier for everyone on campus. 

So what is Students in the Tree? 

The Students in the Tree (SIT) project is part of a larger campus wide effort to establish a 
Common Directory Service (CDS). The Common Directory Service would serve as the 
central database of user information that could be accessed from various systems for a 
variety of purposes. Currently it is common for UNT faculty and staff to have multiple 
user IDs for each system they need access to; in the student’s case, they may have a 
unique user ID for each course requiring computer access in addition to yet more user 
ID’s for various email systems. While the planning for this project has been going on for 
some time now, it continues to get more complicated and involved as additional groups 
start to recognize the advantages inherent to CDS, and express their desire to be 
involved. 

A picture worth a thousand words 


Common Directory Service Big Picture 
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Students in the Tree 


With a little bit of explanation, the picture above begins to make a lot of sense, and soon 
you can see how the Common Directory Service can make using computers on campus a 
little easier to utilize and manage. On the left, you see two images of mainframe 
computer systems, HRMIS and SIMS. Respectively, HRMIS handles faculty and staff 
information and SIMS handles student information. On the right, you see three servers... 
Other Systems, JOVE eMail and the NDS Tree. Without getting into a deep explanation 
of each system, it is just important to know that the NDS Tree (Novell Directory 
Service) is the "network" that sits on every computer on campus and allows you to login 
to network resources. 

SIT Objectives and Benefits 

The general objectives and benefits of SIT are: 

• Each student would be assigned a unique User ID (UID), which would remain 
constant throughout a student’s time at the University. 

• This UID can then be used to access networked computer resources for all classes 
regardless of the location of the resource on Campus. This would also eliminate 
the complicated issue of contextual logins (one’s current place in the network 
tree). 

• Distributed network managers would no longer need to create UIDs for new 
students for each class. 

• The UID could also be used by various email services as well. 

• Time delay problems associated with 3 rd , 4 th , or 12 th day registration rolls 
downloaded or printed from the mainframe are eased, as students would already 
have a UID. 

• With a unique ID, students would no longer have to login to lab machines as the 
lab machine, such as userOOOl or lab0002 etc. With the elimination of impersonal 
naming, it would make it possible to track computer activity by students. 

The bottom line of SIT 

The bottom line to the whole Students in the Tree project is ease of use. From the time a 
new student at UNT starts classes, they will have a unique identifier assigned to them 
that the Common Directory Service recognizes at multiple levels. All student 
information required to keep accounts with the University correct, including billing and 
grades, to signing up for a mail account, to accessing general access lab computers and 
lab computers required for certain classes, ease of use will be the keyed to the student’s 
Unique ID. With a single UID, managing the thousands of student accounts will also be 
made easier, thus saving the University valuable time and money. 

More information? 

If you would like to learn more about the Students in the Tree project, feel free to contact 
your Network manager and/or keep reading Benchmarks Online for updates to this very 
promising project. 
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By Duane Gustavus . UNIX Research Analyst 

Who do you want to be today? 

As you whiz around the Internet leaping whole continents at a single click, you 
might have noticed an insistent murmur about network security. It's nice that 
somebody worries about that sort of thing, but even nicer that you don't have to, 
because it sounds like it could get to be seriously tedious. Sure there are 
nefarious characters out there, but you don't work for the CIA, and there's no 
information in your account other people would even care about, right? 

Wrong; because what they are after is not your term paper nor anything stored in 
your account. What they want is access to your account; in other words, your 
identity. Then they are free to cruise the Net knowing whatever actions they 
take will be attributed to you. 

Starting to get the picture? If not, maybe your focus on the issue will sharpen 
when the FBI knocks on your door to ask about that death threat you sent the 
President. Yes that's hyperbole, but only just. 

In a society where individuals are held individually responsible for their actions, 
it is important to protect your identity. On the Internet where your identity is 
most often established by the account you use to access the network, it is 
important to protect your account. 


Sniffing for passwords 


Before you skip to the next article to avoid another well-meaning (but 
nonetheless incredibly boring) lecture on the importance of managing the 
password for your account, let me interject that the most common way to gain 
access to someone else's account these days does not involve "cracking 
passwords". Why go to that much trouble when you can just grab the password 
right off the network? 


Here's the way it works. There are over 6500 nodes on the unt.edu domain, and 
that number grows almost daily. Most of these nodes are "unmanaged", 
meaning that some portion of the day or night their primary user is not around, 
and at any rate the primary user is not a "systems" type that has the time or skill 
to determine everything the system is doing at any given time. It is relatively 
easy for someone to start a "sniffer" job running in the background which can 
log to a "hidden" file all the connect sessions that appear on that segment of 
network. That file will contain the login name and password of every telnet or 
ftp session over that network segment during the time the sniffer was running. 


If you have a sniffer log file, you don't need to crack passwords to login to 
someone's account; you KNOW the password. Now the system has no way to 
discriminate between you and the real account holder. Until the user changes 
their password (which none of us really enjoy all that much), you can become 
that user anytime you like. 
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Secure shell 

Well, you say, if the network itself is insecure, what do you expect me to do 
about it? Encrypt information before putting it on the network. If this sounds 
suspiciously like I'm trying to get you to learn something new, I'll admit to it 
right up front. I want you to learn how to use ssh (secure shell). Here's why: 
telnet and ftp are very old access methods which were written in the days when 
the Internet was accessible only to a few researchers and computer vendors. 
Computers were slow and encryption of data was deemed an unnecessary 
function in an access method. Both telnet and ftp put the password you enter in 
the network packet just the way you entered it (that is in plain old text). With 
access to the network (over 6500 nodes remember), all anyone has to do is snarf 
the packet as it goes by, and your account is also their account. When you 
access your UNT account from home, the number of network access points 
increases enormously. 

Secure shell encrypts the login dialog with a pretty tough encryption key so that 
if the packet is sniffed, your password is embedded in a matrix of "digital 
noise". The cracker will have to burn some considerable computer cycles to 
retrieve it in a usable form. Generally, it is not worth this much work. It's kind 
of like the police say about having a dog in your yard; there are ways for a thief 
to get around the dog, but the easiest of those is to move on to a house without a 
dog. 

If I have gone to this much trouble to convince you to use this ssh stuff, it must 
be a real pain to use right? Actually, once it is setup, using ssh is really not 
much different from telnet from the user's perspective. Instead of entering a 
command like "telnetjove.acs.unt.edu", you would enter something like "ssh -1 
duanejove.acs.unt.edu". If you were using telnet, jove would respond back with 
a message and "login:" prompt. When you use ssh, the prompt is merely 
something like "duane@jove.acs.unt.edu's password:". You enter your jove 
password, ssh encrypts it before putting in the network packet and sends it 
along. The sshd process in jove then decrypts it and the login process proceeds. 

What about ftp? The ftp protocol has the same security model as telnet (ie none 
at all). There is a companion command to ssh named scp which can be used to 
transfer files. In order to copy a file from my computer to jove, I could use "scp 
foo.c duane@jove.acs.unt.edu:". Notice the trailing ":" character on the 
destination. This command says to copy the file named foo.c in the current 
working directory to the login directory of user duane on the host 
jove.acs.unt.edu. Again you will see the prompt "duane@jove.acs.unt.edu's 
password:" which must be answered with the correct password before the 
transfer is accomplished. 

Does any of this stuff work outside of UNIX? 

As a matter of fact, yes. My guess (in lieu of any research on the subject) is that 
ssh is the most commonly used secure access method in the world. There are 
both commercial and non-commercial (read free) versions. For your 
convenience, ssh and scp are both available on all CSCI and ACS UNIX server 
systems and all CAS General Access Lab PC's. Also, there is a link on the 
Computer Science Department's home page which you can follow to download 
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and configure ssh for your Win95 system at home. There are commercial 
versions of this software available for Mac's, but I am not aware of any free 
legal ssh clients for this platform (sorry). 

Too much trouble? 

Some have pointed out to me that the scp command is not as convenient as the 
point-and-click ftp client they are accustomed to using. Perhaps the extra effort 
of typing a few characters is amply rewarded if your account is not in the sniffer 
log the next time someone wanders through it asking "Let's see; who do I want 
to be today?" 
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The New Wordmarks are Here! 

By Sharon Marek , Web Developer, UNT Central Web Support 

What is a wordmark? 

The University wordmark is our name presented in a specific form. It 
communicates immediately who we are, and is the most commonly used and 
readily identifiable element on official University publications (from the 
University Publication Policy about the Use of the UNT Wordmark in Print). 

Should the wordmark be on my Web page? 

Yes! According to UNT's Web Publishing Guidelines, you should use the 
university wordmark on each home page. "It is necessary that each home page 
indicate the university's name in the wordmark format, which is the university's 
name in a special form. For text-only browsing, an alternate tag with the 
university's name should be provided with the link to the wordmark image file." 

The wordmark doesn't need to be on each page in your Web site, but it should be 
on your home page. And, as with all important images, make use of the alt tag 
to specify representative text for those who can't view the image. 

(UNT's Web Publishing Guidelines are online at 

http://www.unt.edu/irc/pohcy/wehgd1ns.htm ) 

Where are these wordmarks? 

The wordmarks for Web use are located at http://www.unt.edu/images/ — as is 
a link to official UNT logos and wordmarks available for printing in resolution 
independent formats. 

Will the old wordmarks disappear? 

No - the old wordmarks for Web use won't disappear any time soon. And while 
the new wordmarks are displayed at http://www.unt.edu/images/ . the old ones 
will remain on the server for some time. 

But you are encouraged to take advantage of the new wordmarks when 
designing or redesigning your Web site. 
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The Software Crisis 


By Dianna Mullet . Lead UNIX Systems Administrator 

The headlines have been screaming about the Y2K Software Crisis for years 

now. Lurking behind the Y2K crisis is the real root of the problem: The 
Software Crisis. After five decades of progress, software development has 
remained a craft and has yet to emerge into a science. 

What is the Chronic Software Crisis? 

Is there a crisis at all? As you stroll through the aisles of neatly packaged 
software in your favorite computer discount store, it wouldn’t occur to you that 
there’s a problem. You may be surprised to learn that those familiar aisles of 
software represent only a small share of the software market—of the $90 Billion 
software market, a mere 10% of software products are "shrink wrapped" 
packages for personal computers. The remaining 90% of the market is 
comprised of large software products developed to specific customer 
specifications. 

By today’s definition, a "large" software system is a system that contains more 
than 50,000 lines of high-level language code. It’s those large systems that bring 
the software crisis to light. If you’re familiar with large software development 
projects, you know that the work is done in teams consisting of project 
managers, requirements analysts, software engineers, documentation experts, 
and programmers. With so many professionals collaborating in an organized 
manner on a project, what’s the problem? Why is it that the team produces 
fewer than 10 lines of code per day over the average lifetime of the project? 

And why are sixty errors found per every thousand lines of code? Why is one of 
every three large projects scrapped before ever being completed? And why is 
only 1 in 8 finished software projects considered "successful?" 

But wait-there’s more! 

• The cost of owning and maintaining software in the 1980’s was twice as 
expensive as developing the software. 

• During the 1990’s, the cost of ownership and maintenance increased by 
30% over the 1980’s. 

• In 1995, statistics showed that half of surveyed development projects were 
operational, but were not considered successful. 

• The average software project overshoots its schedule by half. 

• Three quarters of all large software products delivered to the customer are 
failures that are either not used at all, or do not meet the customer’s 
requirements. 

Software projects are notoriously behind schedule and over budget. Over the last 
twenty years many different paradigms have been created in attempt to make 
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The Software Crisis 


software development more predictable and controllable. While there is no 
single solution to the crisis, much has been learned that can directly benefit 
today's software projects. It appears that the Software Crisis can be boiled down 
to two basic sources: 

• Software development is seen as a craft, rather than an engineering 
discipline. 

• The approach to education taken by most higher education institutions 
encourages that "craft" mentality. 

Software Development: Craft, or Science? 

Software development today is more of a craft than a science. Developers are 
certainly talented and skilled, but work like craftsmen, relying on their talents 
and skills and using techniques that cannot be measured or reproduced. On the 
other hand, software engineers place emphasis on reproducible, quantifiable 
techniques-the marks of science. The software industry is still many years away 
from becoming a mature engineering discipline. Formal software engineering 
processes exist, but their use is not widespread. A crisis similar to the software 
crisis is not seen in the hardware industry, where well documented, formal 
processes are tried and true, and ad hoc hardware development is unheard of. 

To make matters worse, software technology is constrained by hardware 
technology. Since hardware develops at a much faster pace than software, 
software developers are constantly trying to catch up and take advantage of 
hardware improvements. Management often encourages ad hoc software 
development in an attempt to get products out on time for the new hardware 
architectures. Design, documentation, and evaluation are of secondary 
importance and are omitted or completed after the fact. However, as the 
statistics show, the ad hoc approach just doesn’t work. Software developers 
have classically accepted a certain number of errors in their work as inevitable 
and part of the job. That mindset becomes increasingly unacceptable as software 
becomes embedded in more and more consumer electronics. Sixty errors per 
thousand lines of code is unacceptable when the code is embedded in a toaster, 
automobile, ATM machine or razor (let your imagination run free for a 
moment). 


Computer Science and the Product Orientation 


Software developers pick up the ad hoc approach to software development early 
in their computer science education, where they are taught a "product 
orientation" approach to software development. In the many undergraduate 
computer science courses I took, the existence of software engineering 
processes was never even mentioned. Computer science education does not 
provide students with the necessary skills to become effective software 
engineers. They are taught in a way that encourages them to be concerned only 
with the final outcome of their assignments-whether or not the program runs, or 
whether or not it runs efficiently, or whether or not they used the best possible 
algorithm. Those concerns in themselves are not bad. But on the other hand, 
they should not be the focus of a project. The focus should be on the complete 
process from beginning to end and beyond. Product orientation also leads to 
problems when the student enters the work force-not having seen how 
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processes affect the final outcome, individual programmers tend to think their 
work from day to day is too "small" to warrant the application of formal 
methods. To become effective software engineers, students must be taught how 
the process and product interact. They need to see how a good process 
repeatedly results in a good product. Software process engineering, is, 
unfortunately, not taught until very late in a computer science student’s 
academic career (usually in graduate school), or in company sponsored classes 
on the job. 

Mature Software 


As we have seen, most software projects do not follow a formal process. The 
result is a product that is poorly designed and documented. Maintenance 
becomes problematic because without a design and documentation, it’s difficult 
or impossible to predict what sort of effect a simple change might have on other 
parts of the system. 

Fortunately there is an awareness of the software crisis, and it has inspired a 
worldwide movement towards process improvement. Software industry leaders 
are beginning to see that following a formal software process consistently leads 
to better quality products, more efficient teams and individuals, reduced costs, 
and better morale. 

The SEI (Software Engineering Institute: http://www.sei.cmu.edu/ ) uses a 
Capability Maturity Model (CMM) to assess the state of an organization’s 
development process. Such models are nothing new-they’ve been routinely 
applied to industrial engineering disciplines. What’s new is the application to 
software development. The SEI Software CMM has become a de facto standard 
for assessing and improving software processes. Ratings range from Maturity 
Level 1, which is characterized by ad hoc development and lack of a formal 
software development process, up to Maturity Level 5, at which an organization 
not only has a formal process, but also continually refines and improves it. Each 
maturity level is further broken down into key process areas that indicate the 
areas an organization should focus on to improve its software process (e.g. 
requirement analysis, defect prevention, or change control). 


Level 5 is very difficult to attain. In early 1995, only two projects, one at 
Motorola and another at Loral (the on-board space shuttle software project), had 
earned Maturity Level 5. Another study showed that only 2% of reviewed 
projects rated in the top two Maturity Levels, in spite of many of those projects 
placing an extreme emphasis on software process improvement. Customers 
contracting large projects will naturally seek organizations with high CMM 
ratings, and that has prompted increasingly more organizations to investigate 
software process improvement. 


Mature software is also reusable software. Artisans are not concerned with 
producing standardized products, and that is a reason why there is so little 
interchangeability in software components. Ideally, software would be 
standardized to such an extent that it could be marketed as a "part", with its own 
part number and revision, just as though it were a hardware part. The software 
component interface would be compatible with any other software system. 
Though it would seem that nothing less than a software development revolution 
could make that happen, the National Institute of Standards and Technology 
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(NIST) founded the Advanced Technology Program (ATP), one purpose of 
which was to encourage the development of standardized software components. 
Information on the NIST Advanced Technology Program can be found at 
http://www.atp.nist.gov/atp/overview.htm . 

Engineering: In; Hacking: Out 

The consensus seems to be that software has become too darned big to treat as a 
craft: talent and late-night hacking are out. The artisan approach is charming but 
breaks down when the system is too large for one person to comprehend on his 
own. And while it may not be necessary to apply formal software processes to 
daily programming tasks, it is important in the larger scheme of things, in that it 
encourages developers to think like engineers. 

Further reading on Formal Methods can be found on the Formal Methods WWW 
site: http://www.com1ab.ox.ac.uk/archive/forma1-methods.htm1 . 
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